CVE-2026-107726

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107726", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-08T17:21:52.976Z", "datePublished": "2026-10-08T22:08:09.553Z", "dateUpdated": "2026-10-09T15:12:52.740Z"}, "containers": {"cna": {"title": "Hazelcast: Arbitrary member memory access by low-privileged client", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j"}, {"name": "https://github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f", "tags": ["x_refsource_MISC"], "url": "https://github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f"}, {"name": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/community", "tags": ["x_refsource_MISC"], "url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/community"}, {"name": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise", "tags": ["x_refsource_MISC"], "url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise"}, {"name": "https://github.com/hazelcast/hazelcast/releases/tag/v5.7.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/hazelcast/hazelcast/releases/tag/v5.7.0"}], "affected": [{"vendor": "hazelcast", "product": "hazelcast", "versions": [{"version": "< 5.4.5", "status": "affected"}, {"version": ">= 5.5.0, < 5.5.10", "status": "affected"}, {"version": ">= 5.6.0, < 5.6.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-08T22:08:09.553Z"}, "descriptions": [{"lang": "en", "value": "Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0."}], "source": {"advisory": "GHSA-6v25-8wq6-xq4j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-09T15:07:22.266395Z", "id": "CVE-2026-107726", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T15:12:52.740Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107726", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-09T15:07:22.266395Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T15:07:23.339Z"}}], "cna": {"title": "Hazelcast: Arbitrary member memory access by low-privileged client", "source": {"advisory": "GHSA-6v25-8wq6-xq4j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "hazelcast", "product": "hazelcast", "versions": [{"status": "affected", "version": "< 5.4.5"}, {"status": "affected", "version": ">= 5.5.0, < 5.5.10"}, {"status": "affected", "version": ">= 5.6.0, < 5.6.1"}]}], "references": [{"url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j", "name": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f", "name": "https://github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f", "tags": ["x_refsource_MISC"]}, {"url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/community", "name": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/community", "tags": ["x_refsource_MISC"]}, {"url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise", "name": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hazelcast/hazelcast/releases/tag/v5.7.0", "name": "https://github.com/hazelcast/hazelcast/releases/tag/v5.7.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-08T22:08:09.553Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107726", "state": "PUBLISHED", "dateUpdated": "2026-10-09T15:12:52.740Z", "dateReserved": "2026-10-08T17:21:52.976Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-08T22:08:09.553Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hazelcast", "vendor": "hazelcast", "versions": [{"status": "affected", "version": "< 5.4.5"}, {"status": "affected", "version": ">= 5.5.0, < 5.5.10"}, {"status": "affected", "version": ">= 5.6.0, < 5.6.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0."}], "id": "CVE-2026-107726", "lastModified": "2026-10-09T16:35:35.900", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107726", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-09T15:07:22.266395Z", "version": "2.0.3"}}]}, "published": "2026-10-08T22:17:29.120", "references": [{"source": "security-advisories@github.com", "url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/community"}, {"source": "security-advisories@github.com", "url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise"}, {"source": "security-advisories@github.com", "url": "https://github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f"}, {"source": "security-advisories@github.com", "url": "https://github.com/hazelcast/hazelcast/releases/tag/v5.7.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client", "id": "2548303", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548303"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in Hazelcast. Improper validation of client-supplied data allows a connected client to corrupt memory, potentially leading to arbitrary code execution on cluster members. Additionally, an attacker can exploit this vulnerability to read sensitive memory contents from cluster nodes or crash them, resulting in a denial of service (DoS)."], "mitigation": {"lang": "en:us", "value": "Restrict network connectivity to Hazelcast cluster member communication ports (default TCP 5701 through 5708) using firewall rules so that only verified, trusted client systems can establish connections."}, "name": "CVE-2026-107726", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "maven-resolver", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "maven:3.9/maven-resolver", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Under investigation", "package_name": "hazelcast", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-10-08T22:08:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107726\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107726\nhttps://docs.hazelcast.com/hazelcast/5.7/release-notes/community\nhttps://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise\nhttps://github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f\nhttps://github.com/hazelcast/hazelcast/releases/tag/v5.7.0\nhttps://github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j"], "statement": "This vulnerability is rated as Important severity for Red Hat products because an attacker with network connectivity to a cluster member can remotely access process memory, crash cluster instances, or potentially execute arbitrary code without requiring elevated privileges. Any compromised application or client permitted to connect to the cluster communication port can exploit this input handling flaw to disclose sensitive heap data or trigger cluster-wide denial of service.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.5.0,5.5.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.6.0,5.6.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "hazelcast", "source": "cna", "vendor": "hazelcast"}, "product": "hazelcast", "vendor": "hazelcast"}], "created": "2026-10-08T23:45:16.522566+00:00", "updated": "2026-10-09T13:45:06.791234+00:00", "vendors": ["hazelcast", "hazelcast$PRODUCT$hazelcast"]}